Go version parsing fails for `GOEXPERIMENT=boringcrypto` (`go1.26.0-X:boringcrypto`)

[iblancasa]

Describe the bug

When an application is built with GOEXPERIMENT=boringcrypto for FIPS compliance, the Go toolchain reports a non-standard runtime version string such as go1.26.0-X:boringcrypto.

The auto-instrumentation agent finds the target process successfully, but then fails while parsing that Go version string as semver and exits before any instrumentation happens.

This appears to be a regression introduced in v0.21.0 when the version parsing library was changed in PR #1766. The original suffix-stripping fix for GOEXPERIMENT strings was added earlier in PR #389, but that behavior was lost.

Observed error:

{"level":"ERROR","source":{"function":"main.main","file":"/usr/src/go.opentelemetry.io/auto/cli/main.go","line":169},"msg":"failed to create instrumentation","error":"invalid semantic version"}

To Reproduce

1. Build a Go application with GOEXPERIMENT=boringcrypto.
2. Confirm the binary reports a Go runtime version like go1.26.0-X:boringcrypto.
3. Run opentelemetry-go-instrumentation against that process.
4. Observe that the process is discovered successfully, but instrumentation creation fails with invalid semantic version.

Expected behavior

The agent should normalize Go version strings that contain GOEXPERIMENT suffixes, such as -X:boringcrypto, and continue instrumentation normally.

Additional context

The regression is not limited to boringcrypto; it affects Go version strings that include GOEXPERIMENT suffixes generally.

The previous behavior handled the older spaced form such as 1.22.0 X:nocoverageredesign. Newer Go toolchains can emit the hyphenated form 1.26.0-X:boringcrypto, which also needs to be stripped before semver parsing.

Related PRs:

• PR #389: original GOEXPERIMENT suffix stripping fix
• PR #1766: semver library migration where the regression was reintroduced

[carlosonunez-redhat]

I ran into this today as well. This seems to happen when the runtime version has additional data appended to it, like our Red Hat builds do (or if you built Go off of a debug release).

In short, if go env GOVERSION doesn't look like this:

go1.xx.yy

then auto-instrumentation won't work.